Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to monitor network traffic and EtherApe seems to be nice graphical utility. But the Wikipedia entry says sth like this :

Security: EtherApe requires root privileges to run. As such, there can be risks to the machine(s) running EtherApe when connected to the internet.

I am not getting this , we need to be connected to internet to monitor it, we do not need it at all if we are offline , don't we ?

If there is security risk what it could be and how to use it properly ?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

The security risk is that if someone hacks you and manages to shell it, they will have a root shell. Unfortunately, this is the case with quite a lot of things.

There isn't really a way to definitively protect against this, but a reverse proxy might be a good start, as well as keeping up with patches. Additionally, use a dedicated server or VM for this which has no other function, and keep it firewalled off (in a DMZ) from everything it doesn't need access to.

share|improve this answer
    
VM seems reasonable ,thanks –  sakhunzai Sep 14 '13 at 7:17

It doesn't need to run as root, it just needs to be able to perform some network-related tasks that exceed the usual user permissions. Just use the linux capabilites to only confer these permissions without giving superuser rights:

sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/etherape

Of course its still a slight risk to allow users to monitor all network traffic, but then that is what you are asking for.

share|improve this answer
    
thanks @vbraun , that is excellent suggestion –  sakhunzai Sep 16 '13 at 6:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.